Privacy Policy

Thank you for visiting our website. Protecting your privacy is important to us, particularly when it comes to your personal rights when processing and using personal information. In the following we would like to inform you of how your data is handled pursuant to Art. 13 of the General Data Protection Regulation (GDPR).

Responsible Party
The party responsible for collecting and processing the following data can be found under Impressum – Legal Notice.

In general, it is possible to visit our website without specifying personal data. Any personal data collected on our site (such as name, address, or e-mail address) can be given on a voluntary basis. This data will not be passed on to third parties without your express consent.

Please note that in regard to unsecured data transmission on the internet (e.g. via email), security cannot be guaranteed. Complete protection of your data from third-party access is not possible.

We hereby expressly prohibit the use by third parties of contact data published in the context of legal notice requirements on our website with regard to sending unsolicited promotional and informational material. The website operator hereby reserves the right to take legal action if unsolicited advertising material is sent, for example in the form of spam e-mails.

Transfer of data to third parties
We transfer your data, within the framework of data processing on behalf of a controller in accordance with Article 28 GDPR, to service providers who assist us in operating our websites and the associated processes. Our service providers are strictly bound by our instructions and are contractually obliged to comply with them. We use the following service providers: Hetzner Online GmbH, RealCore Media GmbH, MailChimp, Tumblr, Visitate GmbH & Co. KG, Functional Software, Inc. (Sentry), Matomo, Google Ireland Limited

Some service providers are based in the USA or may transfer data there (Google, MailChimp, Sentry). An adequacy decision has been issued by the European Commission for the USA (EU-US Data Privacy Framework, Article 45 of the GDPR). This applies to companies certified under this framework. The providers listed are certified. In addition, we have agreed to the European Commission’s standard contractual clauses (Article 46(2)(c) GDPR) with them.

Accessing the website and server log files
Our website is hosted on servers operated by Hetzner Online GmbH in Germany. Hetzner processes the data in its capacity as a data processor.
When you access the website, your browser transmits data to the server for technical reasons. This data is stored in server log files:
• IP address
• Date and time of access
• Page or file accessed
• Amount of data transferred and HTTP status code
• Website from which you accessed our site (referrer)
• Browser type and version, operating system
We require this data to deliver the website, ensure its security and defend against attacks. The legal basis is Article 6(1)(f) GDPR. The IP addresses in the log files are deleted after 7 days.
Simply visiting the website does not result in any data being transferred to external providers without your consent (see the following sections).

Cookies and Consent
Cookies are small text files that your browser stores on your device and which can be read. Cookies may contain data that enables the device being used to be recognised. In some cases, however, cookies merely contain information about specific settings that are not personally identifiable. We set strictly necessary cookies without your consent (Section 25(2)(2) TDDDG, Article 6(1)(f) GDPR). All other cookies are only set if you have given your consent (Section 25(1) TDDDG, Article 6(1)(a) GDPR). We do not use any other browser storage such as local storage.

On your first visit, a banner will ask for your consent. You can accept all cookies, allow only the necessary ones, or select individual categories:
• Essential: Storage of your consent, language selection, and access to the press area. Always active.
• Convenience features: Display of YouTube videos. Disabled by default.
• Statistics: Matomo and Google Analytics. Disabled by default.
You can change or withdraw your selection at any time via the ‘Cookie settings’ link at the bottom of every page. Following withdrawal, we will delete the relevant cookies, insofar as this is technically possible.

For logged-in editors, the editorial system sets further technically necessary cookies (login, preview, interface settings). Visitors to the website are not affected by this.

Analysis using Matomo
With your consent, we use the Matomo analytics programme to understand how our website is used and to improve it. Matomo is hosted on our own server. The data is not passed on to third parties.
The following data is collected: pages visited (URL and title), referring page, external links clicked and downloads, date and time, browser, operating system, screen resolution, language setting and approximate location. Your IP address is truncated before being stored (the last two bytes are removed), so that you cannot be identified. We do not maintain user IDs and do not link the data to any other data.
Matomo uses cookies. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You may withdraw your consent at any time via the ‘Cookie settings’. We retain aggregated statistics that do not contain any personal references for a longer period.

Analysis using Google Analytics
With your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’). Google Analytics is only loaded once you have given your consent in the ‘Statistics’ category of the cookie banner.
Google Analytics collects information about your use of the website, such as pages visited, time spent on the site, referring page, device, browser and approximate location. To this end, the cookies mentioned in Section 5 are set. IP addresses are neither logged nor stored by Google Analytics 4. Only the approximate location is derived from the IP address. We do not use user IDs or custom events.
Google processes the data as a data processor. Data may be transferred to Google LLC in the USA.
The legal basis is your consent (Article 6(1)(a) GDPR, Section 25(1) TDDDG). You may withdraw your consent at any time via the ‘Cookie Settings’. Further information: https://policies.google.com/privacy

Error analysis with Sentry
To identify technical errors and improve the stability and loading times of the website, we use the Sentry service provided by Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA.
For the purposes of error analysis and measuring loading times when pages are accessed, the following technical data is transmitted: error message and technical sequence of events leading to the error, URL accessed, browser type and version, referring page and language setting. The data is forwarded to Sentry via our own server. We do not transmit your IP address to Sentry. Sentry does not store IP addresses. Sentry does not set cookies and does not record sessions.
The legal basis is the legitimate interest in ensuring a fault-free and secure website (Article 6(1)(f) GDPR). Sentry does not store any data on your device.
Sentry processes the data as a data processor. The data is stored in the USA and deleted after 90 days.

YouTube Videos
On some pages, we embed videos via YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use the enhanced privacy mode (youtube-nocookie.com).
Videos are only loaded once you have given your consent. No data is transferred to YouTube prior to this. You can give your consent for an individual video (your consent is not stored) or enable the ‘Convenience features’ category in the cookie banner so that all videos are loaded immediately.
As soon as a video is loaded, your browser establishes a connection to Google’s servers. In doing so, Google receives, amongst other things, your IP address, the page you have accessed and information about your browser. During playback, Google may use cookies or similar technologies on your device. If you are logged in to Google, Google may associate the video with your account. Data may be transferred to the USA.
The legal basis is your consent (Article 6(1)(a) GDPR, Section 25(1) TDDDG). Google itself is responsible for the processing carried out by YouTube. Further information: https://policies.google.com/privacy

Contact form and contact via email
You can send us a message via our contact form. When you do so, we process your name, your email address, the subject line and your message. This information is forwarded by email to the contact person you have selected and is not stored on the website. The same applies if you write to us directly by email.
We use your details solely to respond to your enquiry. The legal basis is Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.

Spam protection in forms
To protect against automated submissions (spam), we use a self-operated procedure in all forms: when you fill in the form, your browser solves a simple maths problem. No data is transferred to third parties and no cookies are set. In addition, we limit the number of enquiries per IP address. The IP address is only stored temporarily in the server’s working memory for this purpose and is not stored permanently.
The legal basis is our legitimate interest in protecting our forms from misuse (Article 6(1)(f) GDPR).

Ticketing and Online Registration
On our website, we offer you the opportunity to purchase admission tickets or register for our events. This online ticketing process is managed by Visitate GmbH & Co. KG, which handles the processing of ticket orders or registrations on our behalf and in accordance with our instructions. Personal data that you provide to us when placing a ticket order or registering will be used exclusively for the purpose of fulfilling the relevant contractual relationship in accordance with Article 6(1)(b) GDPR.
Further information can be found here.

Newsletter
On our German website, we provide you with the opportunity to receive our newsletter. Once you have provided us with permission to send you information about museum offers via e-mail, we will process your data in accordance with Art. 6 (1) (a) GDPR. You may revoke your consent at any time without prejudice to the legality of any data processed prior to this. Once your consent is revoked, we will cancel any corresponding data processing.

You may cancel your subscription to the newsletter at any time by sending an e-mail to newsletter@kunsthalle-bremen.de or clicking on the link to unsubscribe found in every newsletter e-mail.

To send our newsletter, we use the services of MailChimp which is provided by The Rocket Science Group, LLC, 512 Means Street, Suite 404, Atlanta, GA 30318, USA, hereinafter “The Rocket Science Group”. Mailchimp is part of the Intuit group of companies and our parent entity is Intuit Inc. In this case, we transfer personal data to the service provider based in the USA, i.e. in a third country outside the EU that is insecure in terms of data protection law. As a guarantee for the data transfer to the USA, we have concluded a standard EU contract with MailChimp. Furthermore, we have concluded a data processing addendum with MailChimp in accordance with Art. 28 GDPR. In addition, The Rocket Science Group provides further data protection information at http://mailchimp.com/legal/privacy/. When you subscribe to our newsletter, the data requested from you during the registration process such as your e-mail address and, optionally, your name will be processed by The Rocket Science Group. In addition, your IP address and the date and time of your registration will be saved. During the registration process, we will obtain your consent to receive this newsletter, describe its contents and refer you to this privacy policy. The newsletter subsequently sent via The Rocket Science Group will also contain so-called tracking bugs, also known as web beacons. The tracking bugs allow us to evaluate if and when you read our newsletter and if you clicked on any links embedded in the newsletter. In addition to other technical information, such as your EDP system data and your IP address, we process this data to optimize our newsletter and cater to the needs of our readers.

Membership application for the Kunstverein
You can apply for membership of the Kunstverein in Bremen via our website, including as a gift for someone else.

•Data processed
We process the details provided in the application: title, first name and surname, date of birth, address, email address, telephone number (if applicable) and occupation, chosen membership type, donation amount (if applicable), preferred method of post delivery and your message. For payment by SEPA direct debit, we process the account holder’s name, IBAN, BIC and bank details.
Mandatory fields are marked on the form. We cannot process your application without this information.
We use the data to establish and manage your membership, to collect membership fees, and to communicate with our members. The legal basis is Article 6(1)(b) of the GDPR. Once you have submitted the form, you will receive a confirmation by email. The confirmation will include your name and the membership type you have chosen.
•Storage and protection
The application will be stored in our database. We store bank details in encrypted form.
Once the application has been transferred to our membership management system, we will delete it from the website. We will store your data in the membership management system for the duration of your membership and beyond, insofar as statutory retention obligations apply.
•Details of other persons
For partner and family memberships, please also provide the names and dates of birth of your partner and your children. For a gift membership, please provide the details of the recipient. We process this data solely for the purposes of the membership (Art. 6(1)(b) GDPR).
Please only provide data relating to other individuals if you are authorised to do so, and inform them of the disclosure of their data and this privacy policy. We will also inform the data subjects when we first make contact, for example via the membership card or a welcome letter.
•Gift membership
In the case of a gift membership, we also process the email address, bank details and, where applicable, the postal address of the person making the gift in order to process the gift. The confirmation email is sent to the person making the gift.
•Newsletters in the membership application
In the application, you have the option to subscribe to individual newsletters, e.g. the Kunsthalle Bremen newsletter. As described in section 13, registration takes place via Mailchimp, but without a double opt-in.

Press Area
Our Press Area is password-protected. There are no personal user accounts. Once you have entered the password, a cookie that does not contain any personal data is set.
If you download press material, we ask you to provide the following details: name, media outlet or editorial team, and planned publication date. We store this information together with the downloaded files and the time of the download. Our press office will be notified of the download by email. You also confirm that you accept the terms of use for the material.
We process this information in order to be able to track the use of the press material in accordance with the terms of use and for press relations purposes. The legal basis is Article 6(1)(b) GDPR (terms of use) and our legitimate interest in ensuring compliance with image and usage rights (Article 6(1)(f) GDPR).

Use of Tumblr for the Blog
For our blog, we have integrated content sharing components from Tumblr into the services on our website. These components are a service of Tumblr, Inc., 770 Broadway, New York, NY, 10003, USA. Every time you visit a page on our website equipped with these "Tumblr" components, your browser is prompted to download the corresponding display of the components from tumblr.com. During this process, Tumblr is made aware of which specific page on our website you have visited and from which IP address. We have no influence on the volume of data nor on the data itself that Tumblr collects through these components. According to our knowledge, the components are not used for any other purpose than displaying the page. You can find more information regarding this in Tumblr’s privacy policy at https://www.tumblr.com/policy/en/privacy. If you do not want Tumblr to associate your visit to our site with your Tumblr account, please log out of your Tumblr account before accessing our site.

Social media
In the footer of our website, we provide links to our social media profiles. These are simple links, not embedded plugins. No data is transferred to the social media platforms when you visit our website. Only when you follow a link do the privacy policies of the respective provider apply.
Further information can be found in the privacy policy for our social media pages.

Data security
We protect your data through technical and organisational measures in accordance with Article 32 of the GDPR. These include, in particular:
• encrypted transmission of all pages and forms (TLS/HTTPS)
• encrypted storage of bank details
• access to personal data restricted to authorised staff only
• hosting in Germany

Your Rights as a User
The GDPR grants you certain rights as a website user over the processing of your personal data:

1.) Right of access (Art. 15 GDPR): You have the right to demand confirmation about whether any personal data concerning you is being processed; where that is the case, you have the right to information about that personal data and other information listed in detail under Art. 15 GDPR.

2.) Right of rectification and erasure (Art. 16 and 17 GDPR): You have the right to demand correction of any inaccurate personal data without delay and also the right to have incomplete personal data completed where necessary. In addition, you have the right to have your personal data erased without delay for one of the reasons listed in detail in Art. 17 GDPR, e.g. if the data is no longer required for the original purpose.

3.) Right to restriction of processing (Art. 18 GDPR): You have the right to demand restriction of processing for one of the reasons listed in Art. 18 GDPR as a prerequisite for restriction, e.g. if you have lodged an objection to such processing for the time it takes to check the accuracy of the data.

4.) Right to data portability (Art. 20 GDPR): In certain cases, listed in detail in Art. 20 GDPR, you have the right to receive the relevant personal data in a structured, commonly used and machine-readable format and also have the right to transmit the data to a third party.

5.) Right to object against processing (Art. 21 GDPR): Where data is processed on the basis of Art. 6 (1) (f) GDPR (data processing on the grounds of legitimate interests), you have the right to object at any time to processing of your data, if there are grounds for objection arising from your particular situation. If you lodge an objection, your personal data will no longer be processed unless we can show evidence of compelling, legitimate reasons for processing it which outweigh your interests, rights and freedoms, or if processing the information serves to assert, exercise or defend our rights or legal claims. Please send any objections to: Kunsthalle Bremen - Der Kunstverein in Bremen, Am Wall 207, 28195 Bremen, Germany, e-mail: info@kunsthalle-bremen.de

6.) Right to lodge a complaint with a supervising authority: In accordance with Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe processing of your data violates any data protection provisions. In particular, a complaint may be lodged with a supervisory authority in the member state of your place of residence, place of work, or in the place where the alleged infringement occurred.

Data Security Officer for the Kunsthalle Bremen - Der Kunstverein in Bremen:
Oliver Stutz, datenschutz nord GmbH, Konsul-Smidt-Str. 88, 28217 Bremen | www.datenschutz-nord-gruppe.de | e-mail: office@datenschutz-nord-gruppe.de | T +49(0)421 - 69 66 32 0

More Info

Legal Notice

Privacy Policy for Social Media
In the following, we would like to inform of how we deal with your data pursuant to Art. 13 of the General Data Protection Regulation (GDPR).

Party Responsible
We, the Kunsthalle Bremen, operate the following social media pages:
•    Facebook: https://www.facebook.com/KunsthalleBremen
•    Instagram: https://www.instagram.com/Kunsthalle.Bremen | https://www.instagram.com/newperceptions.hb
•    LinkedIn: https://de.linkedin.com/company/kunsthalle-bremen
•    TikTok: https://www.tiktok.com/@kunsthallebremen
•    Tumblr: https://blog.kunsthalle-bremen.de
•    YouTube: https://www.youtube.com/KunsthalleBremen
•    X: https://x.com/Kunsthalle_HB

You can find our contact information under Impressum – Legal Notice.

In addition to us, there are the operators of social media platforms themselves. In this respect, they are also parties responsible for processing data, and our influence over them is limited. In those places where we can exert our influence and set the parameters of data processing, we work with the operators of social media platforms towards fair data protections using the means we have available. In many cases, we are not able to exert any influence over the way operators of social media platforms process the data, and we are not precisely aware of what data they process. However, these operators explain how user data is managed in their own privacy policies.

How We Use Your Data
Data such as comments, videos, images, likes, public messages, etc. that you enter on our social media sites are published by the social media platforms and are not used or processed for other purposes at any time. We reserve the sole right to delete content if necessary. Where appropriate we may share your content on our page if this is a function of the social media platform or communicate with you via the social media platform. The legal basis for this is Art. 6 (1) (f) GDPR. Processing the data in such a way is carried out in the interest of public relations and communication.

If you object to the use of specific data being processed over which we have influence, please contact the officer named in our Impressum – Legal Notice. We will verify your objection or direct you to the social media platform if necessary.

If you submit an inquiry on one of the social media platforms, we will refer you to another, more secure means of communication to guarantee confidentiality depending on the answer you require. You always have the option of sending confidential inquiries to the address stated in the Impressum – Legal Notice.

As stated above, we attempt to ensure that our social media pages conform as closely as possible to data privacy regulations as far as allowed by the operators of social media platforms. For this reason, we do not use demographic, interest-based, behaviour-based, or location-based target group definitions for advertising that the operators of social media platforms may make available to us. In general, we do not use social media platforms for advertising purposes. We have little influence over, nor can we switch off the statistics that operators of social media platforms make available to us. However, we make sure that no additional optional statistics are provided to us.

Data Processing by Operators of Social Media Platforms
Operators of social media platforms use web tracking methods. Such web tracking may also occur irrespective of whether you are logged on or registered with the social media platform. As already mentioned, we unfortunately have no control over the web tracking methods of social media platforms. We are, for instance, unable to switch this method off.

Please be aware that it is not out of the question for a social media platform to use your profile and user behaviour data in order to assess such things as your habits, personal relationships, preferences etc. We have no control whatsoever over the processing of your data by the operator of a social media platform.

For more information about data processing by social media platform operators and other ways to object to the use of your data, please refer to the Privacy Policy of the relevant operator:
•    Facebook: https://www.facebook.com/privacy/explanation
•    Instagram: https://help.instagram.com/519522125107875
•    LinkedIn: https://de.linkedin.com/legal/privacy-policy
•    Tumblr: https://www.tumblr.com/privacy
•    TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/de
•    YouTube: https://policies.google.com/privacy?hl=de&gl=de
•    X: https://x.com/de/privacy

In those cases where we are jointly responsible with the social media platform for the processing of data, you will find essential information regarding joint processing of your data here:
• Facebook: https://www.facebook.com/legal/terms/page_controller_addendum

Your Rights as a User
The GDPR gives you certain rights as a website user over the processing of your personal data:
1.) Right to access (Art. 15 GDPR):
You have the right to demand confirmation about whether any personal data concerning you is being processed; where that is the case, you have the right to information about that personal data and other information listed in detail under Art. 15 GDPR.
2.) Right to rectification and erasure (Art. 16 and 17 GDPR):
You have the right to demand correction of any inaccurate personal data without delay and also the right to have incomplete personal data completed where necessary.
In addition, you have the right to have your personal data erased without delay for one of the reasons listed in detail in Art. 17 GDPR, e.g. if the data is no longer required for the original purpose.
3.) Right to restriction of processing (Art. 18 GDPR):
You have the right to demand restriction of processing for one of the reasons listed in Art. 18 GDPR as a prerequisite for restriction, e.g. if you have lodged an objection to such processing for the time it takes to check the accuracy of the data.
4.) Right to data portability (Art. 20 GDPR):
In certain cases, listed in detail in Art. 20 GDPR, you have the right to receive the relevant personal data in a structured, commonly used and machine-readable format and also have the right to transmit the data to a third party.
5.) Right to object (Art. 21 GDPR):
Where data is processed on the basis of Art. 6 (1) (1 f) GDPR (data processing on the grounds of legitimate interests), you have the right to object at any time to processing of your data, if there are grounds for objection arising from your particular situation. If you lodge an objection, your personal data will no longer be processed unless we can show evidence of compelling, legitimate reasons for processing it which outweigh your interests, rights and freedoms, or if processing the information serves to assert, exercise or defend our rights or legal claims.

Right to Lodge a Complaint with a Supervisory Authority
In accordance with Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe processing of your data violates any data protection provisions. In particular, a complaint may be lodged with a supervisory authority in the member state of your place of residence, place of work, or in the place where the alleged infringement occurred.

Contact Details for our Data Security Officer
Our data security officer is available for information or suggestions regarding data security:
Oliver Stutz, datenschutz nord GmbH, Konsul-Smidt-Straße 88, 28217 Bremen | www.datenschutz-nord-gruppe.de | e-mail: office@datenschutz-nord-gruppe.de | T +49(0)421 - 69 66 32 0